Logstash: Simplest pipeline in the history of mankind not working

Using logstash 2.4 (I have my reasons) on Ubuntu 16.04

root@logbox:/etc/logstash/conf.d# ls -al
total 16
drwxrwxr-x 2 root root 4096 Nov  2 19:53 .
drwxrwxr-x 3 root root 4096 Nov  2 15:46 ..
-rwxrwxrwx 1 root root  277 Nov  2 19:52 01_01_input.conf
-rwxrwxrwx 1 root root  604 Nov  2 19:48 03_02_output_pa_http.conf


root@logbox:/etc/logstash/conf.d# cat *.conf

input {

  stdin {}

  file {
    path => "/usr/share/logstash/files/production_input.txt"
    start_position => "beginning"
    # codec => plain { charset => "ISO-8859-1" }
    codec => json
    # add_field => [ 'redis_db', '10' ]
  }


  
}
output {

  stdout {}

}


root@logbox:/etc/logstash/conf.d# ls -al /usr/share/logstash/files/production_input.txt
-rwxrwxrwx 1 root root 11910 Nov  2 16:09 /usr/share/logstash/files/production_input.txt

However...

vagrant@logbox:/etc/logstash/conf.d$ sudo tail -f /var/log/logstash/logstash*


Sending logstash logs to /var/log/logstash/logstash.log.

==> /var/log/logstash/logstash.log <==
{:timestamp=>"2018-11-02T19:59:52.947000+0000", :message=>"Pipeline main started"}

==> /var/log/logstash/logstash.stdout <==
{:timestamp=>"2018-11-02T19:59:52.947000+0000", :message=>"Pipeline main started"}

The file is not printed in stdout...I have tried both codecs (json and plain)

edit: actually it might be the case the file has been read only once; does this have to do with sincedb?
how do I force logstash to read it again? isn't start_position => beginning enough?

Probably. You need to stop Logstash and delete the .sincedb file to make it reread the file.

Any suggestions where this .sincedb file is stored?

The documentation indicates it should be found in the data directory.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.